Security: Overzealous password autocomplete unmasks Incognito users

Issue description

VULNERABILITY DETAILS
Google Chrome's password autofill can take place automatically even while Incognito, allowing a website to correlate a user's Incognito activity with their non-Incognito activity.
This is a variant of the issue IE had a for a short period: http://webdbg.com/ie/InPrivateInfoDisc.htmVERSION
Chrome Version: Version 54.0.2825.0 canary (64-bit)
Operating System: Windows 7
REPRODUCTION CASE
1. Outside of Incognito, in a non-corp account that allows SmartLock password autofill, visit https://whytls.com/password.htm.
2. Enter a password and submit the form.
3. Elect to save the password.
4. Close the browser and open a new Incognito instance.
5. Visit https://whytls.com/password.htm.
6. Click anywhere outside of the autofill box.
OBSERVE: Password field autofills.

PasswordAutofillAgent::TextFieldDidEndEditing feels the need to fill the current password field in cases when the "don't autofill" flag is on. This causes the observed bug.
I'm looking further into the code to understand why PasswordAutofillAgent::TextFieldDidEndEditing behaves in this way.

The code there is to allow filling after the user typed the username without actually selecting suggestions. It is unclear why this only happens in the case when Chrome decides against autofilling. The behaviour has been there since porting from WebKit in 2010 https://chromium.googlesource.com/chromium/src/+/03f57072cd19125c59fbc1d7c76f2856ca200850.
It is unclear what this behaviour's benefits are. It even seems like contraproductive in cases when the user tries to type in their username without using suggestions to prevent autofilling. Getting rid of this code would make PasswordAutofillAgent simpler again, in addition to fixing this bug. I spoke to dvadym@, and it looks like a good idea to us to remove the code. I will give heads-up about this on today's team meeting as well.

Able to reproduce the issue with https://whytls.com/password.htm on mac win and Linux using chrome version 52.0.2743.116 and canary 54.0.2826.0
This is working fine with rsolomakhin.github.io/autofill/